(0Day) Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability

Remote code execution in Hugging Face Transformers via unsafe checkpoint deserialization; user interaction required.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	17 Mar 202611:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses transformers-4.57.3-py3-none-any.whl which is vulnerable to CVE-2025-14920, CVE-2025-14921, CVE-2025-14924, CVE-2025-14926, CVE-2025-14927, CVE-2025-14928, CVE-2025-14929.	2 Mar 202613:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses transformers-4.53.0-py3-none-any.whl which is vulnerable to multiple CVEs.	27 Feb 202611:37	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which is vulnerable to multiple CVEs.	31 Mar 202612:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Hugging Face Transformers bundled with IBM Fusion, IBM Fusion HCI and Content-Aware Storage	13 May 202610:51	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak	14 May 202613:48	–	ibm
Circl	CVE-2025-14929	18 Dec 202505:00	–	circl
CNNVD	Hugging Face Transformers 代码问题漏洞	23 Dec 202500:00	–	cnnvd
CVE	CVE-2025-14929	23 Dec 202521:04	–	cve
Cvelist	CVE-2025-14929 Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability	23 Dec 202521:04	–	cvelist